BreachCalc

Historical record: Mandiant’s December 2017 incident response report describes remote access to a safety engineering workstation, attempted controller reprogramming, and a failed-safe shutdown. The Department of Justice’s March 2022 announcement alleges that TRITON deployments at a foreign refinery caused two emergency shutdowns in 2017. Charges are allegations. Neither source establishes the exercise’s production rates or losses.

Exercise assumptions: The response branches, timing and network illustration are fictional. No explosion, release, injury or equipment damage is modeled. Both branches assume an authorized return to 100 t/h at hour 12, following safety validation. The coordinated branch assumes earlier partial recovery; it is not evidence that a specific response guarantees a faster restart.

Lost output = sum of (100 − interval production rate) × interval hours. Lost contribution = lost tonnes × assumed $200/tonne contribution margin. At hour 12: 1,000 t / $200,000 versus 700 t / $140,000. This excludes response, restart, equipment and environmental costs. These metrics do not modify the financial calculator below. Narration advances stages; muted playback advances at reading pace.

• Mandiant · Original incident response report · December 14, 2017
• U.S. Department of Justice · Indictment announcement · March 24, 2022